{
  "schemaVersion": 1,
  "incident": {
    "id": "cve-2026-94603",
    "url": "https://cveboard.org/i/cve-2026-94603",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-94603",
    "json": "https://cveboard.org/i/cve-2026-94603.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation",
    "summary": "Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox.",
    "titlePt": "Podman: O comando `podman run` pode ser instruído a desabilitar quase todo o sandboxing por meio de anotação de imagem",
    "summaryPt": "O Podman v4.4.0 adicionou um recurso onde pontos de verificação de contêineres (do comando podman container checkpoint) poderiam ser distribuídos via registro OCI, e puxados desse registro e executados via o comando podman run. Isso permitiu a transferência fácil de pontos de verificação entre sistemas. No entanto, os pontos de verificação permitem controle total sobre como o contêiner é criado - incluindo controle total do sandbox do contêiner.",
    "cves": [
      "CVE-2026-94603"
    ],
    "ghsa": "GHSA-2cvf-wqm6-wr9g",
    "cvss": {
      "score": 10,
      "version": "3.1"
    },
    "epss": {
      "percentage": 0.00918,
      "percentile": 0.59508,
      "asOf": "2026-10-23"
    },
    "packages": [
      {
        "ecosystem": "go",
        "name": "github.com/containers/podman",
        "vulnerable": ">= 4.4.0, < 5.8.8",
        "fixed": "5.8.8",
        "advisory": "GHSA-2cvf-wqm6-wr9g"
      },
      {
        "ecosystem": "go",
        "name": "go.podman.io/podman/v6",
        "vulnerable": ">= 6.0.0, < 6.1.3",
        "fixed": "6.1.3",
        "advisory": "GHSA-2cvf-wqm6-wr9g"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-2cvf-wqm6-wr9g"
      }
    ],
    "publishedAt": "2026-10-15T20:22:16.000Z",
    "updatedAt": "2026-10-15T20:22:16.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-2cvf-wqm6-wr9g:ghsa_published:2026-10-15T20:22:16.000Z",
      "incidentId": "cve-2026-94603",
      "type": "ghsa_published",
      "at": "2026-10-15T20:22:16.000Z",
      "detail": {
        "ghsa": "GHSA-2cvf-wqm6-wr9g",
        "severity": "critical",
        "fixed": "5.8.8, 6.1.3"
      }
    }
  ]
}